A helper inside, nothing open from outside.
The admin installs a small program (the AverDesk agent) on a Windows or Linux server inside the office network. It looks around, collects what it finds and sends it to your organization. The connection goes only outward. You open no doors from the internet into your network (no inbound ports).